Hello Christian Schrötter,
not being involded in dovecot packaging I looked at this crash.
That address in event_unref seems to point here:
(gdb) disassemble /m event_unref,event_unref+370
Dump of assembler code from 0x7ffff7f33d70 to 0x7ffff7f33ee2:
...
210
211 void event_unref(struct event **_event)
212 {
213 struct event *event = *_event;
0x00007ffff7f33d70 <event_unref+0>: push %rbp
0x00007ffff7f33d71 <event_unref+1>: push %rbx
0x00007ffff7f33d72 <event_unref+2>: sub $0x8,%rsp
0x00007ffff7f33d76 <event_unref+6>: mov (%rdi),%rbx
<<< $rbx loaded with what $rdi (_event?) points to.
214
215 if (event == NULL)
0x00007ffff7f33d79 <event_unref+9>: test %rbx,%rbx
0x00007ffff7f33d7c <event_unref+12>: je 0x7ffff7f33e60 <event_unref+240>
216 return;
217 *_event = NULL;
0x00007ffff7f33d82 <event_unref+18>: mov 0x78(%rbx),%eax
<<< this instruction seems to crash
0x00007ffff7f33d85 <event_unref+21>: movq $0x0,(%rdi)
218
219 i_assert(event->refcount > 0);
0x00007ffff7f33d8c <event_unref+28>: test %eax,%eax
0x00007ffff7f33d8e <event_unref+30>: jle 0x7ffff7e8c8ca
<event_unref+4294282074>
220 if (--event->refcount > 0)
0x00007ffff7f33d94 <event_unref+36>: sub $0x1,%eax
...
So we might assume $rbx contains here an invalid pointer.
Some lines before, $rbx seems to be loaded with what _event
points to.
Unfortunately you removed all other frames from the backtrace,
therefore it would need a maintainer to be able to reproduce the fault,
to know from where event_unref got called.
But I think it would be easier for them if you could
provide all frames of the backtrace.
Even better would be if dovecot-core-dbgsym from the debug symbol
repository could be installed like described in [1],
before analyzing the core file.
Kind regards,
Bernhard
[1] https://wiki.debian.org/HowToGetABacktrace
